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About this Study Guide 


Preface 


This study guide is an instructional companion to the book Enterprise Cybersecurity: How to Build a Successful 
Cyberdefense Program Against Advanced Threats. This study guide increases students’ understanding of the 
book’s ideas, whether they are using it in the classroom or for self-study. The study guide is structured to be 
self-explanatory and is intended to augment the book's content. For additional information and detail on the 
topics covered in this study guide, please reference Enterprise Security: How to Build a Successful Cyberdefense 
Program Against Advanced Threats by Scott E. Donaldson, Stanley G. Siegel, Chris Williams, and Abdul Aslam 
(Apress, 2015) (www. apress.com/9781430260820). 

Implementing a successful cyberdefense program against real-world attacks is what Enterprise 
Cybersecurity is about. Often in cybersecurity, everyone knows what should be done, but resources to do 
it are not sufficient. Organizations must prioritize their efforts to deploy an incomplete solution that they 
“hope” is sufficient. The challenge lies in how to prioritize resources so security can be as successful as 
possible. As shown in Figure P-1, the Cybersecurity Conundrum often gets in the way of what needs to be 
done, leaving gaps in enterprise cyberdefenses that are exploited by clever attackers. 


The Cybersecurity Conundrum 


What the Defenders Request 


Whatthe 
Attackers 
Exploit 





Figure P-1. Even though the cybersecurity conundrum presents 
significant challenges, implementing a successful cyberdefense program 
that works against real-world attacks is achievable. 


One Cybersecurity Conundrum challenge is that cybersecurity professionals want to implement more 
than what control frameworks specify and much more than what the budget allows. Ironically, another 
challenge occurs even when defenders get everything that they want; clever attackers are extremely effective 
at finding and exploiting the gaps in defenses, regardless of their comprehensiveness. The overall challenge, 
then, is to spend the available budget on the right protections so that real-world attacks can be thwarted 
without breaking the bank and that they also comply with mandated regulatory requirements. 
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Intended Audiences 


As shown in Figure P-2, people involved in or interested in successful enterprise cybersecurity can use this 
study guide to gain insight into an effective architecture for coordinating an entire cyberdefense program. 


Who Should Read This Book 


Business 
Leadership 


Business IT 


Representatives Cybersecurity 


Professionals 





Figure P-2. Successful enterprise cybersecurity is a team sport. 


This study guide is intended for the following audiences: 


e Everyone involved in or interested in successful enterprise cybersecurity. This study 
guide offers material for those who want to use the book to help them do their work. Such 
individuals can use this material to learn about cybersecurity and its challenges, cybersecurity 
implementation, effective cyberdefenses, pragmatic cyberincident response, cybersecurity 
program assessments, and cybersecurity program management. In short, this study guide helps 
those who need to understand the challenges of delivering effective cybersecurity solutions. 


e Students. This study guide recasts the book’s contents as presentation material. This material is 
organized according to the chapter organization of the original book, with major points appearing 
generally in the same order as they appear in the book. Most of the book’s figures, or adaptations 
of these figures, appear in this study guide. Students can use this material in a number of ways in 
conjunction with the text to include the following examples: 


e Before reading a chapter or part of a chapter from the book, students can go to the corresponding 
study guide pages to get a quick look at the chapter or chapter part and understand its major 
points and themes. 


e While reading a chapter or chapter part, students can, in parallel, look at the corresponding 
study guide pages. Sometimes a different look at the same material can facilitate learning. 


e After reading a chapter or chapter part, students can go to the corresponding study guide 
pages to quickly review key points, concepts, and descriptive figures. 
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Instructors. This study guide offers material that instructors can use to develop classroom 
presentations based on the book’s contents. Instructors can also use these pages to incorporate 
material from the book into other courses. For example, an instructor may be teaching a course (or 
part of a course) on the topic of cybersecurity assessments. If such a course is presenting different 
approaches to cybersecurity assessments, “Chapter 11: Assessing Enterprise Cybersecurity” 
and/or “Appendix D: Cybersecurity Sample Assessment” in this study guide may offer the 
instructor ready-made material for demonstrating one example of a comprehensive assessment 
methodology. 


Using Study Guide Material 


This study guide material can be used in a number of ways that include the following: 


Corporate Education. This material can be used to teach a short course to employees within an 
organization or to teach a more detailed course targeted at cybersecurity professionals. The course can 
address all the book’s material or selected material for special topics. 


University Education. This material is suitable for a course at the undergraduate and graduate levels. 
The material can be covered quickly in a single overview course, or it can be covered in more detail as 
part of a larger cybersecurity instruction program. When considered in depth, the material of this study 
guide may be too extensive to be thoroughly covered in a one-semester, three-credit course. 


This guide can be used to structure short presentations on selected topics from the book. In the 
university environment, this approach can be used to structure a graduate-level special topics 
seminar spanning multiple weeks, and perhaps meeting for a couple of hours each week to 
discuss detailed topics drawn from the book and other industry literature. Such a seminar might 
be used to help students conduct their own research and assess other information sources from 
books, literature, and the Internet. 


Professional Conferences and Meetings. The authors offer the following suggestions to those 
involved with establishing cybersecurity training programs: 


e This material can be used to give presentations at professional conferences and other meetings 
pertaining to cybersecurity (such as the Information Systems Security Association İTSSAİ). 


e This material can be used to structure short presentations (say, one hour) to introduce 
employees to key cybersecurity-related topics such as common cybersecurity attacks, 
cybersecurity frameworks, cybersecurity policy, and cybersecurity operational processes. 


e This material can be used to structure half-day or longer presentations dealing with the 
how-tos of such topics as cybersecurity assessments audits and measuring a cybersecurity 
program. 
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e The material can be used to augment existing training activities: 


e The material found in “Appendix C: Object Measurement” can be added to an existing 
presentation on measurement. One purpose of such an addition would be to illustrate 
alternative ways of addressing the challenging problem of meaningful cybersecurity 
measurement. 


e This material can be added to anew module as a self-contained presentation. For example, 
a company may have one or more training modules dealing with different aspects of the 
business case for cybersecurity improvement. This material could be included in a module 
that focuses on return on investment, while another module might focus on cybersecurity 
effectiveness. 


How This Study Guide Is Organized 
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Introduction 

The introduction lays the groundwork for subsequent discussions on how to start, continue, and 
improve an enterprise's cybersecurity. This section provides an introductory understanding of 
Cybersecurity and explains how cybersecurity is with us to stay. 


Part I: The Cybersecurity Challenge 

Part Iis about the cybersecurity challenge and how cybersecurity has changed over the past 
decade. Due to this evolution, the cyberdefense methods that worked well in the past are doomed 
to fail in the future. 


e Chapter 1: Defining the Cybersecurity Challenge 
This chapter defines the cybersecurity challenge facing the modern enterprise and discusses 
the threats against its defenses and why those threats are succeeding at an alarming rate. 


e Chapter 2: Meeting the Cybersecurity Challenge 
This chapter describes how the cybersecurity challenge can be met and how cybersecurity 
controls and capabilities can be organized to prevent, detect, document, or audit malicious 
behavior. 


Part II: A New Enterprise Cybersecurity Architecture 

Part II introduces a new enterprise cybersecurity architecture that is designed to organize and 
manage every aspect of an enterprise cybersecurity program, including policy, programmatics, IT 
life cycle, and assessment. 


e Chapter 3: Enterprise Cybersecurity Architecture 
This chapter describes the new enterprise cybersecurity architecture and explores 17 
functional areas in terms of their goals and objectives, threat vectors, and underlying 
capabilities. 


e Chapter 4: Implementing Enterprise Cybersecurity 
This chapter discusses how to implement the new enterprise cybersecurity architecture 
by identifying security scopes, defining security policies, and selecting security controls to 
counter anticipated threats. 
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Chapter 5: Operating Enterprise Cybersecurity 

This chapter explains how to operate enterprise cybersecurity capabilities and processes, 
including 17 operational processes and 14 supporting information systems essential to effective 
enterprise cybersecurity. 


Chapter 6: Enterprise Cybersecurity and the Cloud 

This chapter discusses how cloud computing is different from the conventional data 
center and explains how the new architecture needs to be tailored for cloud computing 
environments. 


Chapter 7: Enterprise Cybersecurity for Mobile and BYOD 
This chapter describes the trends of mobile computing and Bring Your Own Devices (BYODs) 
and how these two trends solve problems and introduce challenges for the new architecture. 


Part III: The Art of Cyberdefense 
Part III discusses the art of cyberdefense and how the new architecture is deployed and used to 
provide effective risk mitigation and incident response for cybersecurity crises. 


Chapter 8: Building an Effective Defense 
This chapter examines why attackers have great success against legacy cyberdefenses, how the 
steps of the attack are sequenced and how to disrupt them, and how to layer cyberdefenses so 
they effectively thwart targeted attacks. 


Chapter 9: Responding to Incidents 

This chapter describes the incident response process in detail by considering what 
the enterprise needs to do on an ongoing basis to investigate, contain, and remediate 
cybersecurity incidents when they occur. 


Chapter 10: Managing a Cybersecurity Crisis 

This chapter discusses how severe cybersecurity incidents become crises and how the 
enterprise must behave differently in a crisis situation while it struggles to restore normal 
operations. 


Part IV: Enterprise Cyberdefense Assessment 

Part IV establishes a methodology for quantitatively and objectively assessing cybersecurity using 
the enterprise cybersecurity architecture and then mapping those assessments against major 
frameworks for reporting purposes. 


Chapter 11: Assessing Enterprise Cybersecurity 

This chapter explains the cybersecurity assessment and auditing process, and provides 
four worked-out examples using the new architecture to assess cybersecurity posture and 
effectiveness. 


Chapter 12: Measuring a Cybersecurity Program 

This chapter provides a comprehensive method for objectively measuring an enterprise’s 
cybersecurity by looking at risk mitigations, cybersecurity functional areas, and security 
operations. 


Chapter 13: Mapping Against Cybersecurity Frameworks 

This chapter explains how to take the results of an enterprise cybersecurity assessment and 
map them against other cybersecurity frameworks for the purpose of evaluation, audit, or 
compliance reporting. 
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Part V: Enterprise Cybersecurity Program 

Part V brings together the concepts of the rest of the book into a comprehensive enterprise 
cybersecurity program that combines assessment, planning, prioritization, implementation, and 
operations. 


Chapter 14: Managing an Enterprise Cybersecurity Program 

This chapter explains the cybersecurity program management process and shows how the 
enterprise can use it to manage cybersecurity decision-making and prioritize improvements 
to get the best possible value for the investment. 


Chapter 15: Looking to the Future 

This chapter concludes the study guide by discussing the evolution of generations of 
cyberattacks and cyberdefenses, and how enterprise cybersecurity architecture will evolve 
over time to support the enterprise’s needs now and in the future. 


Part VI: Appendices 

The appendices provide greater detail than the chapters and provide important details and 
examples for cybersecurity practitioners who want to use the enterprise cybersecurity architecture 
described in this study guide. 


Appendix A: Sample Cybersecurity Policy 
This appendix provides a sample enterprise information security policy document, organized 
into the 11 functional areas of the new architecture described in this study guide. 


Appendix B: Cybersecurity Operational Processes 
This appendix contains detailed flowcharts for the 17 operational processes of enterprise 
cybersecurity, and it also introduces the 14 supporting information systems. 


Appendix C: Object Measurement 

This appendix introduces the Object Measurement Methodology for objective assessment 
and explains how to use it to measure and report enterprise cybersecurity architecture 
effectiveness. 


Appendix D: Cybersecurity Sample Assessment 

This appendix provides an example enterprise cybersecurity assessment using the 
methodology contained in this study guide, providing multiple levels of details showing how 
different types of assessment can be performed. 


Appendix E: Cybersecurity Capability Value Scales 

This appendix contains detailed, example Object Measurement value scales for measuring the 
performance of each of the 113 enterprise cybersecurity architecture capabilities, grouped by 
the 11 functional areas. 


ABOUT THIS STUDY GUIDE 


Summary 


This study guide is an instructional companion to the book Enterprise Cybersecurity: How to Build 
a Successful Cyberdefense Program Against Advanced Threats. 


This study guide contains landscape-formatted pages that recast the book’s content and new 
content as presentation material. 


This material is organized according to the chapter structure of the original book and is laid out in 
the order that it appears in each chapter. 


This study guide is intended for everyone involved in or interested in successful enterprise 
cybersecurity (business professionals, IT professionals, cybersecurity professionals, students, and 
so on). 


Students, cybersecurity professionals, and IT professionals can use this study guide in a self-study 
manner. Students can also use this study guide to facilitate note-taking in the classroom. 


Instructors can use this study guide to develop classroom presentations based on the book’s 
contents. 


This study guide, in conjunction with the book, can be used by anyone who wants to learn and 
apply what it takes to build a successful cyberdefense program against advanced threats. 
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monitoring/vulnerability/patch 
management, 270 
multi-factor authentication, 262 
network security, 265 
personal use and personal data, 258 
policy/audit/e-discovery/training, 274 
sensors and location awareness, 260 
systems administration, 264 
next-generation cyberdefense axioms, 44 
operations (see Cybersecurity operations) 
people/organization/budgets, 55 
preventive controls, 75 
procedural capabilities, 79 
processes/technologies, 55 
risk management process 
assets, 65 
availability, 66 
confidentiality, 6 
integrity, 66 
risk evaluation, 69 
risk mitigation, 71-72 
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Cybersecurity (cont.) 


risk treatment, 67 

security controls, 68 

threats, 69-70 

vulnerabilities, 69-70 
technological capabilities, 79 
security control, 436 


Cybersecurity effectiveness index (CSEIndex), 568 
Cybersecurity operations 


auditing and deficiency tracking 
process, 190-192 
functional areas 
application security, 207 
asset management and supply 
chain, 214-215 
data protection and cryptography, 209-210 
endpoint/server/device security, 208 
high availability/disaster recovery/physical 
protection, 212-213 
identity/authentication/access 
management, 208-209 
incident response, 214 
monitoring/vulnerability/patch 
management, 210-212 
network security, 206-207 
policy/audit/e-discovery/training, 216-217 
systems administration, 206 
incident response process, 185-189 
information systems, 200-204 
IT operational process, 182 
operational process, 194-199 
operational responsibilities 
business leadership, 177 
IT engineering, 179 
IT operations, 179 
IT strategy/architecture, 179 
security, 178 
process 
account and access periodic 
re-certification, 563 
asset inventory and auditing IT assets, 553 
auditing and deficiency tracking, 552 
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change control, 554 
configuration management database 
re-certification, 555 
control management, 551 
cyberintrusion response, 557 
emergency preparedness, 558 
password and key management, 562 
patch management and deployment, 560 
policies and policy exception 
management, 548 
privileged account activity audit, 564 
project and change security reviews, 549 
risk management, 550 
security monitoring, 561 
supplier reviews and risk assessments, 556 
vulnerability scanning, 559 
risk management process, 184 
vulnerability management process, 185-189 


Cybersecurity policy 


compliance, 520 
guidance, functional area 
application security, 525 
asset management and supply chain, 
541-542 
audit, e-discovery, and training, 543-544 
data protection and cryptography, 531-532 
endpoint, server, and device security, 
526-527 
high availability, disaster recovery, and 
physical protection, 536-538 
identity, authentication, and access 
management, 528-530 
incident response, 539-540 
monitoring, vulnerability, and patch 
management, 533-535 
netvvork security, 523-524 
systems administration, 522 
purpose of, 519 
responsibilities, 520-521 
scope and applicability, 519 
security documentation, 516 
statement, 519 


Cybersecurity sample assessment 
capabilities 

decision-making, 659-661 
expert judgment, 632, 634 
functional area capabilities, 634 
Level3 Index, 632, 656 
maturity, 634, 656 
measurement map, 640 
object characteristic measurement, 642 
object measurement equation, 632 
observed data, 632, 634, 641 
OMIndex, 658 
OM measurement pane, 638 
OM scoring matrix, 636 
operational processes, 634 
program assessment index, 655 
risk mitigations, 634-635 


security operations measurement pane, 639 


17 operational processes, 635 

single combined measurement, 637 

systems administration, 638 

113 capabilities, 635, 641 

utilization, 635, 656 

visualization and analysis, 657 
functional areas 

assessment consideration, 618 

assessment security scope, 618 

comprehensiveness, 620 

effectiveness, 620 

expert judgment value scales, 621 

expert measurements, 623 

expert value judgments, 628 

functional area metrics, 628 

Levell_Index, 620 

Level2_Index, 628, 629 

object characteristic, 626 

OM measurement pane, 624 

OM scoring matrix, 622 

risk mitigations, 620 

security operations metric, 628 

single combined measurement, 623 

value scales, 625 


INDEX 


visualization and analysis, 630-631 
risk mitigations, 605 
attack sequence step metrics, 616 
expert judgment, 609 
expert measurements, 612 
expert value judgments, 616 
Levell_Index, 616, 617 
OM measurement pane, 613 
OM scoring matrix, 611 
risk impact reduction, 609, 617 
risk probability reduction, 609, 617 
single combined measurement, 612 
value scale, 615 
single security scope, 607 


D 


Data protection and cryptography (DPC), 683 
Defense 


attack sequence 
advanced and targeted attacks, 281 
command and control, 283 
data attackers, 281 
foothold, 282 
lateral movement, 285 
mission completion, 286 
privileges, escalating, 284 
processes, 281 

business costs and value 
maximum allowable risk, 294 
security and productivity, 293 
security posture, effectiveness, 295 
security total cost, 296 

cybercastles, 301 

defeat attacks, 300 

design, 309 

detect attacks, 300 

detection rules, 309-310 

disrupt and delay attacks, 300 

incident response, 311 

maze vs. minefields, 298-299 

nested defenses, 302-304 
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Data protection and cryptography (DPC) (cont.) 
network segmentation, 306-307 
resiliency, 312 
security failure 
chain escalation, 291 
endpoint security, 288 
system administration 
channels, 290 
Verizon report, inevitability, 289 
strong authentication, 308 
Developer operations (DevOps), 228, 229 
Developer security operations (DevSecOps), 228, 229 
Discrete value scales, 575 


E 


Endpoint, server, and device security (ESDS), 676 
Electronic Data Systems (EDS), 361 
Enterprise cybersecurity, 566 
Enterprise cybersecurity architecture (ECSA), 89 
application security, 673 
capabilities, 106, 107 
definition, 105 
goal and objectives, 105 
threat vectors, 106 
assessment management and supply chain 
capabilities, 129, 130 
definition, 128 
goal and objectives, 128 
threat vectors, 129 
availability/disaster recovery/physical 
protection 
capabilities, 122, 123 
definition, 121 
goal and objectives, 121 
threat vectors, 122 
cyberattack and defense 
automated response, 500 
before the internet, 496 
biological defense, 501 
casual attackers, 495 
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down market, 502 
future evolution, 503 
harden host, 497 
layered defense and active response, 499 
nation-state attackers, 502 
professional attackers, 495 
protect network, 498 
cybersecurity assessments, 506-507 
cybersecurity capabilities, 508 
cybersecurity implementation, 505 
data protection and cryptography 
capabilities, 116, 117 
definition, 115 
goal and objectives, 115 
threat vectors, 116 
endpoint/server/device security 
capabilities, 109, 110 
definition, 108 
goal and objectives, 108 
threat vectors, 109 
framework, 493 
functional areas, 509 
identity/authentication/access management 
capabilities, 113, 114 
definition, 111 
goal and objectives, 112 
threat vectors, 113 
incident response 
capabilities, 126, 127 
definition, 124 
goal and objectives, 125 
threat vectors, 126 
monitoring/vulnerability/patch management 
capabilities, 119, 120 
definition, 118 
goal and objectives, 118 
threat vectors, 119 
network security 
capabilities, 103, 104 
containment, 50 
definition, 102 


goal and objectives, 102 
threat vectors, 103 
policy/audit/e-discovery/training 
capabilities, 132, 133 
definition, 131 
goal and objectives, 131 
threat vectors, 132 
systems administration 
capabilities, 100, 101 
definition, 99 
goal and objectives, 99 
threat vectors, 100 
Enterprise cybersecurity attack sequence, 32-34 
Enterprise cybersecurity program, 46-50 
Enterprise cybersecurity program management 
assess assets, threats and risks, 455 
assessment phase, 467 
assess security status 
assess risk mitigations, capabilities, and 
security operations, 458-459, 468 
identify deficient areas, 472 
identify target security levels, 470, 471 
prioritize remediation and 
improvements, 473 
collect operational metrics, 465-466 
cybersecurity improvements 
assessment scores, 477, 478 
business application servers, 478 
cybersecurity investments, 480 
general business users, 478 
HIPAA regulated systems, 478 
multiple scopes, 479 
PCI regulated systems, 478 
red-teaming threat scenarios, 476 
risk mitigations, 475 
security capabilities, 475 
security infrastructure, 478 
security operations, 475 
SOX regulated systems, 478 
elements, 48-51 
identify deficient areas, 461 


INDEX 


identify security scopes, 456-457 
identify target security levels, 460 
prioritize remediation and 
improvements, 462-463 
prioritizing improvement 
assessment scores, 485 
factors, 482 
future/prioritizing projects, 483 
immediate/executing projects, 483 
multiple time periods, 486 
next year/resourcing projects, 483 
quantitative measurement, 486 
this year/preparing projects, 483 
resource and execute improvements, 464 
External-facing audit report, 444 


= 


Fulloperating capability (FOC), 352 


G 


Global positioning system (GPS), 260 


H 


Health Insurance Portability and Accountability Act 
(HIPAA), 322, 432, 478 

High availability, disaster recovery, and physical 
protection (HADRPP), 690 

HIPAA regulated systems, 478 


I, J, K 
Identity, authentication, and access management 
(IAAM), 680 
capabilities, 113, 114 
definition, 111 
goal and objectives, 112 
threat vectors, 113 
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Incident response (IR) process, 693 
containment, 324 
detection, 331 
evidence collection, 322 
final report, 328-329 
identification, 318 
investigation, 319-321, 331 
normal IT operations, 330 
remediation, 326, 332 
repair gaps, 325 
report, 323 
validation, 327 
Indicators of compromise (IOC) 
cycle, 319-321 
Information Technology Infrastructure Library 
(ITIL), 144, 494 
Initial operating capability, 352 
Internal-facing audit report, 444 
IT system life cycle 
architect, 144 
deploy, 145 
design, 145 
maintain, 146 
operate, 146 
retire, 147 
security policies, 148, 431 
support, 147 


L 


Lockheed Martin Kill chain, 26-28 


Mandiant attack life cycle, 29-31 
Mobile Device Management (MDM), 263 


Monitoring, vulnerability, and patch management 


(MVPM), 686 
capabilities, 119, 120 
definition, 118 
goal and objectives, 118 
threat vectors, 119 
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N 


National Institute of Standards and Technologies 
(NIST) risk management, 59, 149-150 

Network isolation, 656 
Network security (NS), 90, 669 

capabilities, 103, 104 

definition, 102 

goal and objectives, 102 

threat vectors, 103 


O 


Object measurement (OM). See also Program 
measurement 
cybersecurity-related measurements 
policies and policy exception management, 599 
project and change security reviews, 600 
risk management, 601-602 
two-step measurement approach, 597-598 
displacement, 567 
equation, 571-572 
measurement map 
enterprise cybersecurity program 
assessment, 580 
structure, 579 
principles, 566 
six-step methodology 
expert judgment, 581-587 
observed data, 589-596 
steps, 573 
value scales 
binary, 575 
discrete, 575 
expert judgment, 576-577 
no one set of terms, 575 
observed data, 578 
sliding, 575 
tick-mark labels, 575 
vectors, 566 
Observe Orient Decide Act (OODA ) loop, 347 
OMIndex equation, 571-572 
Out-of-Band (OOB) management, 656 


F Q 


Payment Card Industry Digital Security Standards 
(PCI-DSS), 41 
Payment Card Industry (PCI) standards, 543 
PCI regulated systems, 478 
Personal Card Industry (PCI), 322 
Policy, audit, e-discovery, and training (PAET), 698 
Program measurement 
assessment 
cyberattacks, 413 
measurement map, 416 
SCODES, 415 
value scales, 417-422 
visualization, 426-427 
data observation, 414 
definition, 414 
functional areas 
connectivity, 412 
expert judgment, 423 
value scales, 421 
program assessment index, 424 
risk mitigations 
expert judgment, 423 
value scales, 421 
security controls, 411, 412 
security operations 
expert judgment, 423 
value scales, 421 


R 


Recovery Point Objectives (RPO), 536 
Recovery Time Objectives (RTO), 536-537 
Risk-based method, 564 
Risk management process 

assets, 65 

availability, 70 

confidentiality, 69 

integrity, 70 

risk evaluation, 67 

risk mitigation, 67 

risk treatment, 67 

security controls, 68 
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threats, 66 
vulnerabilities, 66 
Risk mitigations, 71-72, 475 


S 


Sarbanes-Oxley (SOX), 322 
Security Information and Event Management 
(SIEM), 393 
Security Operations Center (SOC), 120 
Security Technical Implementation 
Guides (STIGs), 110 
Security scopes 
business support, 155 
customer-facing, 156 
employee computing, 157 
identification, 154 
RME steps, 149-150 
security and systems 
administration, 155 
selection, 153, 158-159 
test and non-production, 156 
types, 151-152 
Simple Mail Transfer 
Protocol, 310 
Sliding value scales, 575 
SOX regulated systems, 478 
Systems administration 
capabilities, 100, 101 
definition, 99 
goal and objectives, 99 
threat vectors, 100 


T, U 

Threat-based cybersecurity 
audits, 380 

Tick-mark labels value scale, 575 


V, W, X, Y, Z 
Virtual private networking (VPN), 264 
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